It is blocking a deal.
SOC 2, HIPAA or PCI has appeared in somebody else's procurement checklist and your deal is waiting behind it. A gap assessment, a remediation plan, and the evidence an auditor will ask for.
- Fixed fee, not story points
- Gap assessment first
- Evidence an auditor accepts
The problem
Compliance work usually starts as a sales emergency. A large client sends a security questionnaire. The answer to nine questions is no. A signed deal is now waiting on something nobody owns.
The panic response is to buy a compliance platform. It produces a dashboard of red items, which is genuinely useful, and then it stops. A dashboard cannot make the changes. Closing the gaps is engineering work, and that is the part that takes months.
We do the engineering half. We also tell you which controls reduce real risk and which exist because the framework asks.
- Gap assessment against the actual framework, not a generic checklist
- Remediation scoped and sequenced by what blocks the audit first
- Evidence collected as the work happens, not reconstructed afterwards
What this covers
Gap assessment
Every control assessed against your actual systems, with the ones you already satisfy marked as satisfied rather than re-bought.
Technical remediation
Access control, encryption, logging, backup and recovery brought to the standard the framework requires.
Policies that match reality
Written to describe what your team actually does, because a policy nobody follows fails the audit more expensively than a missing one.
Evidence and audit support
The artifacts an auditor asks for, collected in place, plus support through the audit itself.
Why this is not priced in points
Governance, risk and compliance work is never story-point priced. A point is a unit of delivered software. The deliverable here is an opinion: whether your controls meet a standard.
Sizing an opinion in points would be a category error. It would also reward us for finding more work. So this is a fixed fee or a retainer, quoted after the gap assessment. Software built to close a gap is estimated in points as normal, and drawn from your existing lane.
What an auditor follows
- Control
- The test that exercises it
- The artifact it leaves
- Attestation
What it costs
The gap assessment is a fixed fee. We quote it from the framework and the number of systems in scope. It produces the remediation estimate, and that estimate is a commitment rather than a range.
Most clients need the assessment before they can budget anything. That is exactly why it is sold on its own.
- Gap assessment: fixed fee, quoted upfront
- Remediation: fixed fee or retainer, quoted from the assessment
- Software built to close a gap is estimated in points, from your lane
- SOC 2, HIPAA, PCI DSS, ISO 27001 and GDPR
Bring us the backlog.
In 30 minutes, we will show you what a Pod would ship first and how we would price it.